Malware removal terms

Last updated: 14 November 2026

This is an English translation provided for convenience. In case of discrepancy, the Spanish version prevails.

These terms govern the diagnosis, malware removal and hacked WordPress site recovery service provided by Diego Meijide Garcia (AGENCIA RSE), Tax ID (NIF) 47381046B, with address at Plaza Agramar 3, 15172 Oleiros (A Coruña), Spain. When you order, you tick the acceptance box at checkout and they are accepted. This is a translation; if there is any discrepancy, the Spanish version prevails.

1. Options and price

• Diagnosis only: €34 + VAT, paid in full when ordering. We review the symptoms, files, logs and database we can access, and give you a report with our findings, the estimated scope and a proposed course of action. It does not include removing the malware or repairing the site.
• Clean-up and recovery: €95 + VAT in total, in two payments: €47.50 + VAT when ordering and €47.50 + VAT when the work is done.
• Urgent recovery: €150 + VAT in total, in two payments: €75 + VAT when ordering and €75 + VAT when the work is done. It includes everything in the clean-up with priority: your site goes ahead of non-urgent work, subject to availability. It is not a guaranteed deadline.

Prices are shown excluding VAT; VAT is added on the invoice. Each order covers a single WordPress site (one domain and one installation).

2. What the clean-up includes

• Diagnosis of the infection and how far it goes.
• A backup of the site as it is before we intervene, if the hosting allows it.
• Removal of the malicious code, backdoors and unauthorised users or access we find.
• A clean reinstall of WordPress core, the theme and the plugins from their official or vendor sources.
• New WordPress passwords and keys, and a note of the ones you must change yourself (hosting, email, FTP).
• Fixing the way the attackers got in, when it can be identified.
• A review request to Google in Search Console if the site is flagged as dangerous and you give us access to the property.
• A final report of what we found and did.

3. What it does not include

• Rebuilding or redesigning the site, or recovering content the attack destroyed that does not exist in any backup.
• Other sites on the same hosting. If several are infected, each one is ordered separately; if they are not cleaned, they can reinfect ours.
• Premium plugin or theme licences, hosting, domain and email.
• Recovering search rankings or removing the site from third-party blacklists beyond requesting the review.
• Ongoing maintenance. We offer it separately, with no obligation.

4. The process, step by step

1. Order and first payment. You pay 50% of the service (or 100% of the diagnosis) and accept these terms.
2. Access. You give us a WordPress administrator user and access to the hosting (panel, FTP or SFTP and database). Timeframes start once we have all the access we need.
3. Diagnosis. We review the site and tell you what happened and what we are going to do. If we find the clean-up is not viable, or the work goes well beyond what is described in section 2, we tell you before going on (see section 6).
4. Clean-up. We make the backup and do the work in section 2.
5. Review mode. When we finish, we install a small add-on on your site that shows the public a maintenance page and lets you see the whole site through a private link we email you. Search engines receive a temporary unavailability notice (status 503), which does not affect rankings if it lasts a few days. The WordPress dashboard, payments and connections from other services keep working.
6. Your check. You have 7 calendar days to check the site and tell us about any problem related to the infection or our work. We fix it at no cost and let you know again.
7. Final payment and opening. When you are satisfied, you pay the remaining 50% with the link we send you. Once it arrives, we remove review mode (usually the same working day), request the Google review if needed and hand you the final report.

If 7 days pass without you reporting any problem, the work is considered accepted and the final payment is due.

5. If the final payment does not arrive

• The site stays in review mode and we send you payment reminders by email.
• We never delete or change your content because of non-payment, nor do we remove your access. Your hosting and your data are yours at all times.
• You can remove review mode yourself at any time by deleting the file wp-content/mu-plugins/rse-verificacion.php. Doing so does not cancel the outstanding payment if the work is finished and accepted.
• If payment is not settled within 30 days of delivery, we may claim it through legal channels and will not hand over the final report until we receive it.

6. If the clean-up is not viable or you cancel

• If, after the diagnosis, the clean-up is not viable or the work needed goes well beyond what is described, we explain it in writing with a proposal. If you do not accept it, we hand you the diagnosis and refund the first payment minus €34 + VAT, the price of the diagnosis.
• If you cancel before we start the diagnosis, we refund the first payment in full.
• If we have not received access within 15 days of ordering, the service is cancelled and the above applies.

7. What we need from you

• Administrator access to WordPress and to the hosting, which must be yours or which you are authorised to give us.
• That you do not make changes to the site or the hosting while we work, unless we agree it.
• That you change the passwords we point out (hosting, email, FTP) when we ask you to.

8. Guarantee and liability

We fix at no cost any remains of the infection found during your check (section 4). Nobody can guarantee that a site will not be attacked again: a new infection from a different cause, from not keeping the site updated or from other sites on the same hosting is a new service.

We make a backup before intervening and work carefully, but we depend on the state of the site, the hosting and third-party software. Our total liability for the service is limited to the amount paid, except in cases of wilful misconduct or gross negligence.

9. Confidentiality and data

We use the access and information about your site only to provide the service, and we recommend changing the passwords you gave us once we finish. If your site processes personal data, we act as data processor and sign the corresponding agreement with you if you need it. If the attack may have exposed personal data, we say so in the report so you can assess whether you must notify it. More information in the privacy policy.

10. Right of withdrawal

If you order as a consumer, you have 14 calendar days to withdraw. When ordering, you ask us to start straight away, given the urgency of the service. If you withdraw, you pay for the proportion of the work already done, and once the service has been fully provided you lose the right of withdrawal, under Article 103 of the Spanish consumer protection law (Ley General para la Defensa de los Consumidores y Usuarios).

11. Governing law

These terms are governed by Spanish law. For any dispute, the parties submit to the courts of A Coruña, unless the law gives a consumer the right to go to the courts of their place of residence.